Background
4 The appellant arrived in Australia in September 2010 on a month-long tourist visa. He was apprehended nearly three years later and taken into immigration detention at Villawood. While in detention he applied for a protection visa, claiming to be a Christian who fears harm from local officials in his country of nationality. A delegate of the Minister refused to grant the visa and that decision was affirmed by the Refugee Review Tribunal on review.
5 On 12 March 2014, exactly a month after the Tribunal's decision, while the appellant remained in immigration detention, presumably awaiting his removal, the Department advised him that there had been unauthorised access to his personal information (the data breach). The circumstances in which this occurred are set out in the High Court's judgment in Minister for Immigration and Border Protection v SZSSJ; Minister for Immigration and Border Protection v SZTZI [2016] HCA 29; (2016) 334 ALR 653; 90 ALJR 901 (SZSSJ).
6 It appears that the data breach occurred following the publication on the Department's website on 14 February 2014 of embedded information disclosing the identities of 9,258 detainees who had applied for protection visas (the information). The information that was disclosed was protected from disclosure by criminal sanctions: see Migration Act, Pt 4A. The appellant was one of those detainees. The information in his case consisted of his name, date of birth, nationality, gender, the fact that he had overstayed his visitor's visa, and the duration of his time in detention. The information remained on the website for two weeks.
7 The Department arranged for the firm, KPMG, to investigate the data breach. KPMG conducted an investigation and reported to the Department. An abridged version of the KPMG report was made available to affected applicants. The abridged version revealed that the information had been accessed 123 times and that the access had originated from 104 unique IP addresses. It did not, however, disclose the IP addresses or the precise times of access. It merely "acknowledge[d] that access originated from a range of sources, including media organisations, various Australian Government agencies, internet proxies, TOR network and web crawlers". It also noted that there was nothing to indicate that the disclosure of the underlying data was intentional or malicious. But as the High Court observed in SZSSJ at [7]:
Irrespective of the cause of the disclosure there was obviously a risk that those in other countries from whom applicants for protection visas claimed to fear persecution or other relevant harm might have gained access to the document containing the embedded information so as to become aware of the identities of applicants for protection visas in Australia.
8 The appellant filed an application in the Federal Circuit Court seeking an injunction preventing his removal from Australia as a result of the data breach but, according to the Commonwealth Courts Portal, that application was discontinued on 19 January 2015.
9 On 27 June 2014 the Department wrote to the appellant inviting him to put in writing his concerns. In the event that he had "any particular concerns about the impact of the data breach on [his] ability to return to [his] home country or country of usual residence", he was asked to provide the Department within 14 days with "specific reasons and details for those concerns". He was also told that he would be advised of the outcome of the assessment and that, if it was adverse to him and he had no ongoing matters before the courts or the Department, he would be expected to leave the country.
10 Three days later, Ms Byers, who is also a migration agent, responded on the appellant's behalf. She noted, amongst other things, that The Guardian newspaper had reported that the information had been accessed in 16 countries including China. She stated:
There is no way of knowing who [SZTZM] could face a real risk of harm from as it may go well beyond the authorities in China, including foreign security and intelligence agencies, terrorist organisations and criminal syndicates. In addition, the Human Resources Sections of companies and public service departments would also have access to the information and would undermine [SZTZM]'s ability to find employment and foreign governments may use this information as a reason not to grant visas for him to travel out of China. The possibilities are endless[.]
11 In a follow up letter Ms Byers notified the Department that the appellant also relied on the claims he had made in his protection visa application and in his application for review in the Tribunal.
12 On 13 January 2015 the assessor informed the appellant that an ITOA had begun. She told the appellant that the purpose of the assessment was to assess whether the circumstances of his case engage Australia's non-refoulement obligations. As she later explained in her decision, Australia's non-refoulement obligations arise under a number of international treaties and are incorporated in s 36(2) of the Migration Act. They require that a contracting State not expel a refugee (defined in Article 1A of the Convention relating to the Status of Refugees) where the refugee's life or freedom would be threatened on account of any of his or her race, religion, nationality, membership of a particular social group, or political opinion. They also require that a person not be forcibly returned, deported or expelled to a place where there are substantial grounds for believing that, as a necessary and foreseeable consequence of his or her removal to a receiving country, there is a real risk (s)he will suffer "significant harm", defined in s 36(2A) to mean the arbitrary deprivation of life, the imposition of the death penalty, torture, cruel or inhuman treatment or punishment or degrading treatment or punishment.
13 The assessor explained the reason for the assessment and advised the appellant that any protection claims he may have in relation to "this breach of [his] personal data" would now be assessed through the ITOA. She told him that the assessment would consider Australia's non-refoulement obligations, any new information and changes in his circumstances or nationality or former habitual residence since his previous protection claims were considered. She assured him that he would receive procedural fairness during the ITOA process because the assessor will ask him to comment on "any adverse information, which is credible, relevant and significant to the decision". She invited the appellant to provide any further information he would like to be considered in the assessment.
14 The following day the appellant replied, through Ms Byers. The letter contained no such information. It merely noted that the Department had all the information in relation to the data breach and complained that the appellant would be denied procedural fairness unless the Department disclosed it to him. It also complained that the assessor, as an employee of the Department, could not conduct an impartial review.
15 On 5 February 2015 the assessor invited the appellant to provide additional comment on information relevant to the ITOA, attaching adverse information which would be considered and advising the appellant of the inferences that might be drawn from the information. In the attachment the assessor addressed the concerns about procedural unfairness. For present purposes it is sufficient to observe that the appellant was advised:
When assessing protection claims in relation to the privacy data breach, case officers are instructed to assume that the authorities in the claimant's receiving country may have accessed personal information released on the department's website. Case officers will refer to the claimant's personal circumstances and country information to determine whether the privacy data breach will affect the individual if he or she is returned to his or her country of origin.
The reason for this approach is that, although the KPMG review found that there were relatively few internet users who accessed the document, it is not possible to discount the possibility that the authorities in another country may have accessed this document. Accordingly, releasing the IP addresses, the unabridged KPMG report, or other information related to the privacy data breach, is·not required for a claimant to participate in this process.
16 Ms Byers replied that the appellant continued to rely on all his previous statements, submissions and statutory declarations made in relation to his application for a protection visa. Relevantly, she submitted that, without access to the information held by the Department, "all assumptions and claims made are speculation only". She was critical of the assumption the assessor indicated would be applied, saying it was too narrow. She complained that it could not be assumed that "only the home country" had accessed the information, particularly when the country information (disclosed in the attachment to the assessor's letter) did not deal with "the scenario of a foreign government placing the names and details of asylum seekers held in immigration detention facilities on the world wide web …". In these circumstances, she submitted that the appellant should be found to be a refugee sur place. This submission, I hasten to add, had also been made in the earlier correspondence.
17 On 19 March 2015 the assessor determined that Australia's non-refoulement obligations were not engaged in the appellant's case.
18 In her reasons for decision, the assessor began by noting the purpose of the assessment. After satisfying herself of the appellant's identity, she recounted the relevant history, including the correspondence passing between him or his agent and the Department. Amongst other things, she noted the discontinued application in the Federal Circuit Court and observed:
He stated that the publication of his private information rendered him a refugee 'sur place' and for Australia to return him to China would be in breach of the non-refoulement principle contained in Article 33 of the United Nation's Refugee Convention and incorporated into section 36(2)(a) of the Migration Act 1958. The claimant advised he was concerned that the sharing of his confidential information with his country of origin, including the fact that he applied for asylum in Australia, could create serious repercussions for him with the Chinese authorities.
19 The assessor then summarised Australia's non-refoulement obligations. She found that the appellant was a citizen of China and that China was therefore the relevant country for the purpose of assessing whether he was owed non-refoulement obligations.
20 She said that, apart from the claims concerning the disclosure of the information on the Department's website, there was no evidence to indicate that the appellant's circumstances had changed since his protection claims were assessed by the Tribunal, he had provided no new information, and the Tribunal's decision did not suggest any legal error. Consequently, she said, she accepted the Tribunal's findings. She then proceeded to examine the implications of the data breach.
21 She noted that the appellant had claimed that the personal information released on the Department's website, including his protection claims, could cause him to be harmed by "the Chinese authorities" on return to China. But she observed that the information disclosed on the website did not include any details of his protection claims. She said she was unable to find any country information to indicate that a person in the appellant's particular situation would have a profile that could potentially cause him to be subjected to a real chance of serious harm or a real risk of significant harm by the Chinese authorities.
22 The assessor then turned to consider whether the appellant faces a real risk of serious harm or a real risk of significant harm by the Chinese authorities on return to China because of his unauthorised absence from China and his unlawful residence in Australia since 2010. On this question she said:
As the claimant departed China lawfully, I do not consider that he would be subjected to any form of punishment in relation to his departure from his country of origin. However, in relation to his now prolonged, unauthorised absence from China and unlawful residence in Australia, taking into account the country information cited above and his personal circumstances, I consider that the claimant could be briefly detained and questioned at the border on return to China. However, I consider that brief detention for questioning under such circumstances would be in line with China's laws of general application concerning exit and entry procedures at the border and would not be for any Convention reason. I do not consider the claimant would be subjected to serious harm or significant harm which is systematic and discriminatory and therefore it would not amount to persecution. In the claimant's particular case, given that he does not have an adverse profile with the Chinese authorities, even if the Chinese authorities were to suspect he remained in Australia for economic reasons and/or that he applied for a Protection visa in order to remain in Australia, I am satisfied that other than being briefly detained for questioning regarding his absence from China and his reason(s) for remaining in Australia, the claimant does not have an adverse profile with the Chinese authorities that could cause him to be subjected to a real chance of serious harm amounting to persecution, nor a real risk of significant harm.
23 The assessor noted the submission that the information could be dispersed beyond authorities in China and that this could affect his ability to find employment or obtain visas. Since his country of "reference" (presumably nationality) is China, however, and the latter submission speculative, the assessor declined to address these matters.
24 In the covering letter the assessor informed the appellant that he should make arrangements to leave Australia voluntarily and that, if he did not, the Department was required to make arrangements to remove him "once all matters relating to [his] immigration status [had been] finalised".